diff --git a/docs/admin-guide.md b/docs/admin-guide.md
index 6b68bc7c159..500d6027269 100644
--- a/docs/admin-guide.md
+++ b/docs/admin-guide.md
@@ -221,6 +221,17 @@ auth_service:
     # certificates and keys (may need to wipe out /var/lib/teleport directory)
     cluster_name: "main"
 
+    # List (array) of other clusters this CA trusts.
+    trusted_clusters:
+      - key_file: /path/to/main-cluster.ca
+        # Comma-separated list of OS logins allowed to users of this 
+        # trusted cluster
+        allow_logins: john,root
+        # Establishes a reverse SSH tunnel from this cluster to the trusted
+        # cluster, allowing the trusted cluster users to access nodes of this 
+        # cluster
+        tunnel_addr: 80.10.0.12:3024
+
 # This section configures the 'node service':
 ssh_service:
     enabled: yes
@@ -254,17 +265,6 @@ proxy_service:
     # nodes.
     tunnel_listen_addr: 0.0.0.0:3024
 
-    # List (array) of other clusters this CA trusts.
-    trusted_clusters:
-      - key_file: /path/to/main-cluster.ca
-        # Comma-separated list of OS logins allowed to users of this 
-        # trusted cluster
-        allow_logins: john,root
-        # Establishes a reverse SSH tunnel from this cluster to the trusted
-        # cluster, allowing the trusted cluster users to access nodes of this 
-        # cluster
-        tunnel_addr: 80.10.0.12:3024
-
     # The HTTPS listen address to serve the Web UI and also to authenticate the 
     # command line (CLI) users via password+HOTP
     web_listen_addr: 0.0.0.0:3080